StackRadarChart IndexLive demo

CVE-2022-48285

High

Advisory

Published 29 Jan 2023In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.3; base score, highest
EPSS: 0.014; 71st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 14; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 1 of 1; affected package

JSZip contains Path Traversal via loadAsync

Carried by container images the latest versions of 14 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
jszipnpm	2.4.0, 2.5.0, 3.4.0, 3.6.0+2 more	3.8.0	14

OSV records: GHSA-36fh-84j7-cv5h

Charts affected

14 by stars

Chart

Latest

Affected images

Radar Score

kobotoolboxone-acre-fund

2 of 9 See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
enketo/enketo-express :3.0.4	dcad9c2273f6	jszip@3.7.1	3.8.0
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	jszip@3.7.1	3.8.0

Open the chart page →

18,517

browserless-chromesagikazarmark

1 of 1 See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	jszip@3.7.0	3.8.0

Open the chart page →

24,488

wekan-oldgabisonfire

1 of 1 See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
wekanteam/wekan :v4.22	68a51f0327df	jszip@3.4.0	3.8.0

Open the chart page →

5,941

cryptpadgeek-cookbook

1 of 1 See more

cryptpad geek-cookbook 0.4.2

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
promasu/cryptpad :v4.14.1-nginx	51d1142b9f95	jszip@3.7.1	3.8.0

Open the chart page →

974

Governify-Bluejaygovernify

1 of 12 See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
governify/registry :v3.4.0	d3f37f4f8168	jszip@3.4.0	3.8.0

Open the chart page →

22,512

Governify-Falcongovernify

2 of 10 See more

Governify-Falcon governify 0.1.0

2 of the 10 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
governify/collector-dynamic :v1.3.0	6d3d1a5b46a9	jszip@3.4.0	3.8.0
governify/registry :v3.4.0	d3f37f4f8168	jszip@3.4.0	3.8.0

Open the chart page →

24,319

ibm-microclimateibm-charts

1 of 8 See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-theia :latest	e17bdccc5030	jszip@2.5.0	3.8.0

Open the chart page →

57,669

ohmyformkrzwiatrzyk

1 of 1 See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
ohmyform/ohmyform :1.0.3	afe53f4acdb1	jszip@3.7.1	3.8.0

Open the chart page →

4,230

finance-portalmojaloop

1 of 11 See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
mojaloop/reporting :v12.1.0	d480a62103d6	jszip@2.5.0	3.8.0

Open the chart page →

14,809

reporting-legacy-apimojaloop

1 of 1 See more

reporting-legacy-api mojaloop 2.2.0

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
mojaloop/reporting :v12.1.0	d480a62103d6	jszip@2.5.0	3.8.0

Open the chart page →

1,948

1 of 1 See more

5,215

wekanschmitzis

1 of 1 See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
quay.io/wekan/wekan :v5.65	cb17600883a3	jszip@3.7.1	3.8.0

Open the chart page →

3,638

vehicle-dashboardtest-vehi-dash

1 of 7 See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
samajh/alprfrontend :latest	05ef4fddbb75	jszip@2.4.0	3.8.0

Open the chart page →

20,270

genievhdirk

1 of 1 See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2022-48285.

Container image	Digest	Package	Fixed in
stanfordoval/almond-server :latest	1a63cdccedaf	jszip@3.7.1	3.8.0

Open the chart page →

3,129

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
governify/registry :v3.4.0	d3f37f4f8168	jszip@3.4.0	3.8.0	2
mojaloop/reporting :v12.1.0	d480a62103d6	jszip@2.5.0	3.8.0	2
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	jszip@3.7.0	3.8.0	1
enketo/enketo-express :3.0.4	dcad9c2273f6	jszip@3.7.1	3.8.0	1
governify/collector-dynamic :v1.3.0	6d3d1a5b46a9	jszip@3.4.0	3.8.0	1
gristlabs/grist :0.7.9	6e71b1914a7e	jszip@3.6.0	3.8.0	1
ibmcom/microclimate-theia :latest	e17bdccc5030	jszip@2.5.0	3.8.0	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	jszip@3.7.1	3.8.0	1
ohmyform/ohmyform :1.0.3	afe53f4acdb1	jszip@3.7.1	3.8.0	1
promasu/cryptpad :v4.14.1-nginx	51d1142b9f95	jszip@3.7.1	3.8.0	1
samajh/alprfrontend :latest	05ef4fddbb75	jszip@2.4.0	3.8.0	1
stanfordoval/almond-server :latest	1a63cdccedaf	jszip@3.7.1	3.8.0	1
wekanteam/wekan :v4.22	68a51f0327df	jszip@3.4.0	3.8.0	1
quay.io/wekan/wekan :v5.65	cb17600883a3	jszip@3.7.1	3.8.0	1